@coffre/db 0.10.2 → 0.11.0

package/dist/migrations/sqlite/meta/_journal.json

@@ -106,6 +106,13 @@
       "when": 1792345777255,
       "tag": "0014_custom_roles",
       "breakpoints": true
+    },
+    {
+      "idx": 15,
+      "version": "6",
+      "when": 1792803757926,
+      "tag": "0015_workload_access",
+      "breakpoints": true
     }
   ]
 }

package/dist/portable.d.ts

@@ -1,5 +1,5 @@
-import { m as schema_d_exports } from "./schema-NBVA9q-s.js";
-import { t as Database } from "./database-DBtn3jqp.js";
+import { h as schema_d_exports } from "./schema-DG2t57Kf.js";
+import { t as Database } from "./database-Dh4W2pAj.js";
 import { t as schema_sqlite_d_exports } from "./schema-sqlite.js";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
 //#region src/portable.d.ts

package/dist/{schema-NBVA9q-s.d.ts → schema-DG2t57Kf.d.ts}

@@ -1,5 +1,5 @@
 declare namespace schema_d_exports {
-  export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
 }
 declare const projects: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "projects";
@@ -2293,6 +2293,23 @@ declare const serviceBindings: import("drizzle-orm/pg-core").PgTableWithColumns<
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    policy: import("drizzle-orm/pg-core").PgColumn<{
+      name: "policy";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
     label: import("drizzle-orm/pg-core").PgColumn<{
       name: "label";
       tableName: "service_bindings";
@@ -3163,6 +3180,195 @@ declare const mcpApprovals: import("drizzle-orm/pg-core").PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
+/**
+ * Enrollment codes (docs/design/workload-access.md, section 4.4): what CI
+ * mints for a platform that signs no identity, and the app exchanges for a
+ * workload's session at `/api/auth/workload`. Never a credential itself, and
+ * only ever added: the log says which code a promote superseded. Its scope,
+ * fixed at minting, is the binding's within what the minter held; the MAC
+ * covers everything but its hint and creation time (auth-rows.ts in the server).
+ */
+declare const enrollments: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "enrollments";
+  schema: undefined;
+  columns: {
+    id: import("drizzle-orm/pg-core").PgColumn<{
+      name: "id";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    authMac: import("drizzle-orm/pg-core").PgColumn<{
+      name: "auth_mac";
+      tableName: "enrollments";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    bindingId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "binding_id";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    codeHash: import("drizzle-orm/pg-core").PgColumn<{
+      name: "code_hash";
+      tableName: "enrollments";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    codeHint: import("drizzle-orm/pg-core").PgColumn<{
+      name: "code_hint";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    scope: import("drizzle-orm/pg-core").PgColumn<{
+      name: "scope";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_at";
+      tableName: "enrollments";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdBy: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_by";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdWith: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_with";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "expires_at";
+      tableName: "enrollments";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
 /**
  * Bearer credentials coffre issues itself: browser sessions, CLI sessions and
  * service tokens.
@@ -3485,6 +3691,125 @@ declare const credentials: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    jkt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "jkt";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    notAfter: import("drizzle-orm/pg-core").PgColumn<{
+      name: "not_after";
+      tableName: "credentials";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    ancestors: import("drizzle-orm/pg-core").PgColumn<{
+      name: "ancestors";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    constraints: import("drizzle-orm/pg-core").PgColumn<{
+      name: "constraints";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    enrollmentId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "enrollment_id";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    approvedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "approved_at";
+      tableName: "credentials";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    approvedBy: import("drizzle-orm/pg-core").PgColumn<{
+      name: "approved_by";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
   };
   dialect: "pg";
 }>;
@@ -3734,4 +4059,4 @@ declare const environmentsRelations: import("drizzle-orm").Relations<"environmen
   environment: import("drizzle-orm").One<"environments", true>;
 }>;
 //#endregion
-export { secrets as _, deviceAuthorizations as a, vaultGrants as b, environmentsRelations as c, mcpConnections as d, oauthClients as f, secretVersions as g, secretReferences as h, credentials as i, identities as l, schema_d_exports as m, auditLog as n, dismissedKeys as o, projects as p, consumedTokens as r, environments as s, auditChainHead as t, mcpApprovals as u, secretsRelations as v, vaultMembers as x, serviceBindings as y };
+export { vaultMembers as S, secretVersions as _, deviceAuthorizations as a, serviceBindings as b, environments as c, mcpApprovals as d, mcpConnections as f, secretReferences as g, schema_d_exports as h, credentials as i, environmentsRelations as l, projects as m, auditLog as n, dismissedKeys as o, oauthClients as p, consumedTokens as r, enrollments as s, auditChainHead as t, identities as u, secrets as v, vaultGrants as x, secretsRelations as y };